#514 – Goodbye, WordPress

This week we moved parabol.co off of WordPress and onto EmDash, Cloudflare’s new open-source CMS.

In Friday Ship #499 I wrote about how we left HubSpot’s content management system for WordPress, and how remarkably simple, fast, and cost-effective it was at the time. That was true for years. But this year, the reasons we chose WordPress quietly became reasons to leave it.

Cloudflare launched EmDash in April, calling it a “spiritual successor” to WordPress. It’s written in TypeScript, runs serverless on Cloudflare’s network, and every site comes with an API and an MCP server, so AI agents can work with its content directly.

We wanted a website that was more AI-native, more performant, and less expensive to run.

AI-native. In Friday Ship #507 we wrote that the command line is quickly becoming the primary interface for a lot of our work. Our website is no exception. Editing pages, fixing search settings across dozens of pages at once, even putting this post into our CMS now happens through an API our AI agents can use, not by clicking through an admin screen one page at a time.

Performant. Our pages are now served from Cloudflare’s edge, close to whoever is reading them, rather than from a PHP server that builds each page on request.

Cost-effective. Our spend on our CMS platform has gone from thousands of dollars per month, to hundreds when we switched WordPress providers earlier this year, to tens of dollars a month now. That’s two orders of magnitude in less than a year.

It’s a good example of how quickly the economics of the SaaS industry are changing. In Friday Ship #508 we replaced HubSpot with Attio and vibe-coded what Attio didn’t cover. In Friday Ship #512 we asked whether SaaS survives AI at all. Our website is now one more line item where the price of “good enough” has collapsed.

On Wednesday, PHP shipped an emergency release for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell.” According to CISA’s alert, they “allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests.” CISA is urging everyone to patch immediately, and to take systems running unsupported versions of PHP offline until they’re updated.

WordPress runs on PHP. Had we still been on it this week, we’d have been one of the millions of sites scrambling to patch. EmDash doesn’t run PHP at all, and we finished our move just days before the news broke.

While we missed this event, I’m anxious that critical CVEs will be the new normal.

Early next year we’re planning a new website and a rebrand. On WordPress, a redesign meant rebuilding a theme that was tangled up with years of plugins and page-builder markup. On EmDash, our content is structured data behind an API, so a redesign is mostly a front-end project, and the content comes along for the ride.

More on that when we’re ready to show it off. If you’ve made a move off WordPress yourself, I’d love to compare notes.

Website sessions were 10,734 this week, 1.7% above the four-week average, while new signups (1,163) and meetings run (1,553) slipped 5.3% and 8.5% below theirs. There were bright spots, though. Stand-Ups were up 18.5% over the four-week average, a few weeks after we shipped structured Stand-Up templates. Visits from people who first found us through an AI assistant were up 19.3%, which is exactly the traffic our new site is built for. And 49.6% of the people who signed up the week before ran a meeting within seven days, ahead of 45.6% at this time last year.

…shipped active users over time. It went out in v15.5.0 on Monday. Each org can now count how many people were active in any past month from its own membership history. A team now counts as “active” only if it has at least two members and held a meeting in the last 30 days that at least two people joined. This work is hiding in our API, for now, but will soon be available to everybody when we ship our new reporting features.

…rebuilt how you invite people by email. The Invite to Team dialog and the new-team form now use a chip input, one chip per address. Instead of one generic error, or an address that silently goes nowhere, Parabol tells you what happened to each address and how to fix it: a suggested fix for a typo, an edit, or a retry. Invites now also respect team permissions on personal access tokens, a request can include up to 50 addresses, and nobody gets the same invite twice within 10 minutes. It’s in v15.6.0, out Thursday.

…finished embeds in Pages. Part 4 of 4 is here. Embeds get a toolbar for alignment, full width, card or embed view, aspect ratio, reload and replace, and you can drag the edges to resize them, the same as images.

…gave every Team Health category an AI summary. When a check is revealed, each category with at least three answers gets a short summary on its result card and a sentiment score we’ll use in Reports. The AI also writes the question that opens that category’s discussion, replacing the old conversation starter. It’s merged and goes out with v15.7.0.

…made team pages load faster. Task cards used to wait on live GitHub, Jira, Azure DevOps, GitLab and Linear lookups before showing up. A team page with about 44 GitHub-linked tasks took about 2.8 seconds. Now the cards show up right away and issue details fill in as they arrive.

…fixed a stack of smaller things. Teams with two recurring series of the same meeting type due at the same moment no longer lose one of them. People invited through SSO no longer get a stray personal org and team. The approved-domain error now names the email we checked and the organization. The org Teams table fits on phones and shows the right member counts for public teams. Personal access tokens now record when they were last used.

…begin week 5 of 6 of Shape Up Cycle 16.

…land Reports behind its flag and switch team labels from a hierarchy to tags, so an org can look at “engineering in EMEA” without filing every team under a region by hand.

…ship work drawers built from the integration registry. Tabs will be ordered by how popular each integration is, with Jira first, and “Jira” becomes “Jira Cloud.” It’s still in review.

…keep sketching ad-hoc meetings, prompted by a customer request: start a meeting and invite people without setting up a team first. Our leading idea: create a hidden team behind the scenes, open the invite dialog when the meeting starts, and archive the team when the meeting ends.